Introduction

How can a industrial organization benefit from partnering with a OT security consultant? 

Industrial Control Systems (ICS) and underlying Operational Technology (OT) infrastructure are becoming more complex and faces increasing threats that can disrupt operations and effect people safety. Operational challenges to maintain a robust and stable infrastructure and be proactive in detecting and mitigating threats stretches many companies’ capabilities and reaction time.

The question that management are often confronted with is: “should we increase skilled staff and invest in ongoing training to cope, or should we engage skilled consultants to help with risk assessments, process and procedures or compliance gaps analysis and recommendations, or even outsource Cyber Security operations to a trusted 3rd party”? The right answer depends on your company’s unique challenges. Often the right approach is a mix or hybrid approach that could include one or multiple of these options. In this article we will focus on the reasons and benefits for engaging consultants.

 1. Independent Evaluation or Assessment

The need to meet compliance or conformance often requires an independent review or assessment. Who you consider and hire to achieve your objectives are driven by trust and most often specialized credentials for the job. Experienced consultants with good credentials and references that matches your needs are often hired based on your own experience with them individually, the service provider they are working for, or previous references that you can validate.

Benefits: Independent evaluation very often overcome or challenge status quo by reviewing existing controls and practices for completeness, effectiveness, and efficiency. Risk assessments bring external knowledge and threat experience that will challenge your own perspectives and help understand and validate your actual (jointly realized) threat exposure versus your organization’s risk appetites. A good consultant will enhance your insights, identify gaps, and make practical recommendations that will help you prioritise and remediate findings based on real risk to your business.

 2. Insight and Experience to Improve a Process or Capability

Often internal processes or capabilities are not challenged or improved as a result of many reasons (e.g., attitude of “do not change what works” (lack of appetite for change), hardened processes not challenged for improvement, or resource constraints (skills, budget, complexity)). However, when changes are required (often driven by an event or incident, or perhaps a proactive assessment and recommendations) you may need an expert to help you with these tasks. The expert needs to provide credentials to show insight and experience with the task assignment to ensure reasonable expectations for delivery within budget and time.

Benefits: Hiring an experienced consultant with insight to quickly adapt to your environment, policies, and practices, should bring quick results and ensure staff skills enhancements and training are included in the delivery.

3. Specialized Skills Required under Special Circumstances

Often companies’ team skills are challenged to manage an incident or with unplanned projects or remediation activities. Such scenarios are defined as special or unplanned circumstances (e.g., emergency incident response and associated remediation activities, audit support or readiness planning for compliance, new technology solutions to meet requirements and associated integration with existing systems or processes).

Benefits: Experienced consultants that can work under pressure bring external experience to deal with your specific requirements within reasonable timeframe. Consultants would be familiar with the compliance requirements and can assist you with interpretation and your readiness by helping to develop and implement the controls required to pass certification or audit reviews. Certified and experienced SME’s can help with designing, implementing, and integrating technical solutions in your environment and interface with vendor support teams to make the solution deployment a more seamless experience.

4. Strategic Cyber Security Planning and Roadmap Development

Understanding risk and threats to an organizations OT infrastructure and ICS systems are fundamental ingredients to assist with strategic planning. Consultants with industry experience in OT Operational Management and service delivery, together with knowledge and insights of global threat landscapes, can gain quick understanding of your core needs and requirements in a short order of time to enable proven and practical advice to management regards strategic initiatives to improve your Cyber Security Posture and ability to deal with known and unforeseen threats.

Benefits: Experienced consultants that specializes in Cyber Security programs and practices, complimented with years of cross industry experience and threat landscapes, will provide great value in helping an organization to strategize and build roadmaps that aligns to your company’s risk profile and business directives.

5. Cyber Security Program or Controls Practices Development and Implementation